aws / aws/aws-appsync-community
@aws_auth(cognito_groups: ["users"]) works, @aws_cognito_user_pools(cognito_groups: ["users"]) doesn't
- Dominant language
- HTML
- Stars
- 507
- Forks
- 37
- PR merge metrics
- No merged PRs in 30d
Description
I am getting a successful response when using `@aws_auth(cognito_groups: ["users"])`. However, when I attempt to use `@aws_cognito_user_pools(cognito_groups: ["users"])`, I receive the following error:
```json
{
"errors": [
{
"path": [
"getCheck"
],
"data": null,
"errorType": "Unauthorized",
"errorInfo": null,
"locations": [
{
"line": 3,
"column": 5,
"sourceName": null
}
],
"message": "Not Authorized to access getCheck on type Query"
}
]
}
```
I am using `AMAZON_COGNITO_USER_POOLS` as the primary AppSync auth mode, with no additional auth modes. My understanding (according to docs [here](https://docs.aws.amazon.com/appsync/latest/devguide/security-authz.html#using-additional-authorization-modes)) is that these should be interchangeable if `AMAZON_COGNITO_USER_POOLS` is the only auth mode that's used.
> You can use the @aws_cognito_user_pools directive in place of the @aws_auth directive, using the same arguments.
I am able to proceed with the `@aws_auth` directive, but wanted to raise this issue as it was quite confusing to encounter.
Contributor guide
Research direction
Start with the AppSync GraphQL schema directives and the API authentication-mode configuration described in the issue, then compare @aws_auth with @aws_cognito_user_pools when AMAZON_COGNITO_USER_POOLS is the only mode enabled. Verify the behavior against the linked authorization documentation; done means the two directives have the documented equivalent authorization behavior or the discrepancy is clearly documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, graphql
- Domain
- api, authentication, authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100